Application Security Engineer

DecisionPoint Corporation is seeking an Application Security Engineer to support federal and DoD-aligned mission applications. The role focuses on application-layer security assessments, secure coding reviews, vulnerability analysis, threat modeling, security testing, and integrating security controls across CMS components, APIs, custom code, and CI/CD pipelines.

Responsibilities:

• Conduct secure code reviews, focusing on application logic, API endpoints, CMS modules, and backend integrations
• Perform API security assessments to validate authentication, authorization, data handling, and boundary protections
• Support CMS hardening by reviewing templates, modules, configurations, and custom components for secure implementation
• Integrate security requirements into CI/CD pipelines including SAST/DAST tools, dependency scanning, and automated controls
• Manage secrets handling, encryption policies, and secure storage of API keys, tokens, and credentials
• Conduct static and dynamic application security testing, vulnerability assessments, and remediation validation
• Provide secure coding guidance to developers, architects, and product teams
• Work with DevSecOps and cloud engineers to ensure secure build and deployment patterns
• Perform threat modeling and recommend mitigations for high-risk application features
• Review and validate authentication flows, SSO integrations, and identity-related protections
• Assist with security documentation including test results, remediation plans, and secure configuration records
• Support continuous monitoring, log analysis, and triage of application-layer security alerts
• Participate in sprint teams, code review cycles, and architecture discussions to embed security early

Requirements:

• Must hold an active Top Secret clearance, supported by a Tier 5 background investigation
• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related technical field
• Minimum 7 years of experience in application security engineering, secure software development, or cybersecurity
• Experience conducting code reviews, application penetration testing, or API security testing
• Experience with static and dynamic testing tools, dependency scanning, and software composition analysis
• Experience supporting secure CI/CD pipeline integration and DevSecOps practices
• Experience implementing secure secrets management, encryption, and authentication protections
• Strong understanding of OWASP Top 10, secure coding principles, and application-layer attack vectors
• Experience with SAST/DAST tools, dependency scanners, and code review workflows
• Knowledge of API security, token-based authentication, and secure data handling
• Familiarity with CMS structures, template security, and module-level risk considerations
• Understanding of identity and access management, certificate management, and secure authentication flows
• Security+ or CISSP or CCSP
• Strong analytical and problem-solving skills for identifying and remediating application-layer vulnerabilities
• Ability to clearly communicate technical risks, secure coding guidance, and remediation recommendations
• Strong attention to detail when reviewing code, configurations, and test results
• Ability to work collaboratively with developers, cloud engineers, PMO staff, and mission stakeholders
• Commitment to integrating security early and continuously throughout the development lifecycle
• Experience with AWS cloud-native application security tools
• Familiarity with container security, Kubernetes workload protections, and microservices security
• Experience with modern CI/CD platforms and DevSecOps automation
• AWS Security Specialty
• GIAC secure coding or cloud security certifications
• Certified Ethical Hacker (CEH)